AMENDMENTS TO THE CLAIMS 

The following listing of claims will replace all prior versions and listings of claims 
in the application. 

Listing Of Claims 

Cancel claims 1 -6 

7. (Currently Amended) A security administration server as cla i med in c l a i m 
6, whoroin installed in a predetermined LAN, comprising : 

means for collecting information relating to a communication conducted via said 
LAN by a device to be monitored operating in said LAN; 

means for generating an image by extracting information useful for security 
management in said LAN from said collected communication related information and 
visualizing said information to a predetermined form; 

means for sending said image to a monitoring device wherein: 

said LAN is connected to an external network such as the Internet; and 
said image generating means comprises: 

means for generating an image visualizing into respective 
predetermined objects; 

said device to be monitored; 

a device operating in said external network which communicates 
with said device to be monitored; 

a user using said devices; and 
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communication conducted between said device to be monitored 
and said device operating in said external network; 

said image generating means comprises a function for generating an image 
structured with an area displaying a text message as it is[[,]] ; 

an area displaying as a graph; 

an appearance frequency of a predetermined character string in said log 
information^,]] ; 

an area displaying as a graph an appearance frequency of said character string 
for each predetermined unit time period in a time series[[,]] ; and 

an area displaying as a graph the length of each line of said text message, based 
on a log information structured with describing various processes conducted in each of 
said devices to be monitored in a text message format including such content and 
execution time and date in separate lines. 

8. (Previously Presented) A security administration server as claimed in 
claim 7, wherein 

said device to be monitored comprises: 

means for managing a log file which is the entity of the log information in the form 
of an original file and a plurality of duplicate files thereof managed with the same 
contents as said original file in real time, and for storing and managing each file 
distributed to a plurality of storing places suitably defined in a storing means in said 
device to be monitored; 

means for suitably transferring each duplicate file to another said storing place; 
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means for detecting whether or not there is an abnormality in security in both of 
said original and duplicate log files; and 

means for notifying said security administration server when an abnormality is 
detected of such fact and/or its content; 

wherein said image generating means comprises means for reflecting in said 
image a fact and/or its content of detecting said abnormality notified from said device to 
be monitored. 

9. (Currently Amended) A security administration sever as claimed in any of 
claims 7 or c l aim 8, comprising: 

means for receiving an updating data sent from a predetermined computer 
operating in said external network; and 

means for updating a content of a software providing said image generating 
means by said updating data. 

10. (Currently Amended) A security administration server as claimed in any of 
claims 7 to c l aim 9, comprising means for transmitting and receiving said collected log 
information to and from said computer by communicating with said predetermined 
computer operating in said external network. 

1 1 . (Currently Amended) A security administration server as claimed in any of 
claims 7 to claim 10, comprising: 
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means for storing and managing various setting-registration information such as 
information of said device to be monitored from which said log information is collected, 
and information used and/or referred to by said image generating means; and 

means for transmitting and receiving said setting-registration information to and 
from said computer by communicating with said predetermined computer operating in 
said external network. 

12. (Currently Amended) A security administration server as claimed in any of 
claims 7 to c l aim 1 1 , comprising: 

means for detecting an abnormality in security of said device to be monitored or 
said security administration server itself, by communicating with a predetermined 
computer operating in said external network, based on said collected log information 
and log information of said security administration server stored and managed by itself; 
and 

means for transmitting and receiving to and from said computer when an 
abnormality is detected of such fact and/or its content. 

13. (Currently Amended) A security administration server as claimed in any of 
claims 7 to etaim 12, comprising: 

means for communicating based on a TCP/IP protocol with each device to be 
monitored; 

means for allocating predetermined IP addresses according to a request from 
each device to be monitored in said LAN as well as for storing and managing allocated 
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histories describing histories of corresponding said IP addresses and MAC addresses of 
each device to be monitored; 

means for storing and managing said collected communication related 
information attached with an IP address specifying which said deice to be monitored 
said communication related information concerns; 

means for handling said communication related information attached with IP 
addresses corresponded to a same MAC address in said allocated history, as a 
communication related information regarding the same said device to be monitored. 

14. (Currently Amended) A security administration server as claimed in claim 
13, comprising: 

means for mutually transmitting and receiving said allocated history to and from 
other security administration servers operating in said LAN; and 

means for i ntogratod l y managing . in an integrated manner, said allocated history 
in another security administration server that is received and said allocated history 
stored and managed by said server itself[[,]] ; and-to 

handlo means for handling said communication related information attached with 
IP addresses corresponding to a same MAC address in respect to these allocated 
histories, as a communication related information regarding the same device to be 
monitored. 

15. (Currently Amended) A security administration server as claimed in claim 
13 or 14, comprising means for specifying a MAC address wherein each combination of 
a MAC address and an IP address described corresponding to said allocated history is 
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attached with a valid period information of said IP address, said valid period information 
and a generated time and date of said communication related information recorded and 
attached to said collected communication related information are compared, and a MAC 
address corresponding to an IP address attached to said communication related 
information at said generated time and date is specified. 

16. (Original) A host server functioning as said predetermined computer in 
claim 9, comprising means for suitably sending said updating data to said security 
administration server. 

17. (Original) A host server functioning as said predetermined computer in 
claim 10, comprising means for storing and managing said communication related 
information sent from said security administration server. 

18. (Original) A host server as claimed in claim 17, comprising means for 
sending said communication related information which is stored and managed to said 
security administration server. 

19. (Currently Amended) A host server as claimed in claim 17 or 18 
comprising: 

means for detecting an abnormality in security regarding said device to be 
monitored based on said communication related information which is stored and 
managed; and 
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means for sending to a security administration server installed in a relevant LAN 
of the fact and/or its content when an abnormality is detected. 

20. (Currently Amended) A host server as claimed in any of claims 17 to 
claim 19, comprising: 

means for receiving said various setting information sent from said security 
administration server, or the fact and/or its content of detecting said abnormality and for 
storing and managing such information. 

21. (Currently Amended) A host server as claimed in claim 19 or 20, 
comprising: 

means for communicating with a portable telephone via the Internet or a 
telephone network; and 

means for reporting to a predetermined portable telephone by a voice call or an 
electronic mail, of the fact and/or its content when the host server itself detects an 
abnormality, or the fact and/or its content of detecting said abnormality sent from said 
security administration server. 

22. (Currently Amended) A host server as claimed in any of claims 17 to 
claim 21 , comprising: 

means for communicating with a portable telephone via the Internet; 
means for receiving an inquiry message regarding said communication related 
information sent from a predetermined portable telephone; 
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means for retrieving said communication related information corresponding to 
said inquiry message from said communication related information which is stored and 
managed; and 

means for sending a message described with such retrieved result to said 
portable telephone. 

23. (Currently Amended) A host server as claimed in any of claims 17 to 
daim 22 comprising: 

means for communicating with a portable telephone via the Internet; 

means for receiving information specifying said device to be monitored sent from 
a predetermined portable telephone and a processing command executed in said 
device; 

means for sending said processing command to a device specified by said 
specifying information via the Internet; and 

means for receiving an execution result of said processing command sent from 
said device, for editing said execution result to an image of a form suitable for a user 
interface of said portable telephone, and for sending such image to said portable 
telephone. 

24. (Currently Amended) A security administration server as claimed in any of 
claims 7 to claim 23, comprising means for collecting communication packets, wherein 
said communication related information is communication packets flowing in said LAN. 
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25. (Original) A security administration server as claimed in claim 24, 
comprising means for directly obtaining said communication packets via said LAN. 

26. (Currently Amended) A security administration server as claimed in claim 
24 or 25, comprising means for concentrating via said LAN communication packets 
which are obtained by said device to be monitored operating in said LAN and stored 
and managed in said device to be monitored. 

27. (Currently Amended) A security administration server as claimed in any of 
claims 24 to c l aim 26, comprising: 

means for calculating at least one portion of a value of the number of said 
devices to be monitored or a number totaling the number of devices into predetermined 
groups, a number of communication packets transmitted and received by said device to 
be monitored via said LAN, and a number totaling such number of communication 
packets in predetermined groups; and 

means for generating an image visually expressing a value of at least one portion 
of each calculated value and for sending said image to said device to e monitored which 
is connected to via said LAN. 

28. (Previously Presented) A security administration server as claimed in any 
of claims 24 to claim 27, comprising: 

means for storing and managing access-limitation information in respect to said 
device to be monitored; 
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means for monitoring unauthorized access violating said access-limitation 
information based on said communication packets; and 

means for generating an image visually expressing the effect when recognizing 
said unauthorized access and sending said image to said monitor device. 

29. (Currently Amended) A security administration server as claimed in any of 
claims 24 to claim 28, comprising: 

means for storing and managing access authorization information for each 
system operating in said device to be monitored; 

means for monitoring unauthorized access violating said access authorization 
information based on said communication packets; 

means for generating an image expressing the fact of when an access violating 
said access authorization information is recognized; and 

means for sending said image to said monitoring device. 

30. (Currently Amended) A security administration server as claimed in any of 
claims 24 to claim 29, comprising means: 

for generating an image by drawing an image visualizing communication 
conducted between each of said devices to be monitored or an access situation of a 
user of each device to be monitored based on said communication packets and an 
access situation from each device to be monitored or a user to a database operating in 
each device to be monitored, as overlapping an image where an abstract design of 
each device operating in said LAN is disposed to form according to an actual 
arrangement state of each device; and 
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for sending said image to said monitoring device. 



31 . (Currently Amended) A security administration server as claimed in any of 
claims 24 to daim 30, comprising means for detecting a use history of said device to be 
monitored of each user using said device to be monitored based on said communication 
packets and sending an image describing said use history to said monitoring device. 

32. (Currently Amended) A security administration server as claimed in any of 
claims 24 to claim 31 , comprising: 

means for totaling the number of communication packets transmitted and 
received to and from said device to be monitored which is examined based on said 
communication packets, for each system operating in said device to be monitored; 

means for generating an image visualizing said totaled value for each system; 

and 

means for sending said image to said monitor device. 

33. (Currently Amended) A security administration server as claimed in any of 
claims 24 to claim 32, comprising: 

means for examining an operating state of said device to be monitored based on 
said communication packets; 

means for generating an image visualizing an operating state of each device to 
be monitored by classifying into each system operated by using said device to be 
monitored; and 

means for sending said image to said monitoring device. 
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34. (Currently Amended) A security administration server as claimed in any of 
claims 24 to c l aim 33, comprising: 

means for detecting an access frequency to a database operated by said device 
to be monitored based on said communication packets; 

means for generating an image visualizing by classifying for each device to be 
monitored or for each system operated by using said device to be monitored; and 

means for sending said image to monitoring device. 

35. (Currently Amended) A security administration server as claimed in any of 
claims 7 to cla i m 34, comprising: 

means for collecting via the LAN execution histories of a program in said device 
to be monitored which is accumulated and recorded in said device to be monitored; 

means for generating an image visualizing an execution history of a program in 
said device to be monitored based on said execution history; and 

means for sending said image to said monitoring device. 

Cancel claims 36 - 40. 

41 . (Currently Amended) A security administration server as claimod i n c l aim 
40, whoroin installed in a LAN connected to an external network such as the Internet, 
comprising : 

means for passively or actively collecting a log information stored and managed 
by a device operating in said LAN: 
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means for generating an image visualizing information to a predetermined form, 
where said information is extracted as useful for security management in said LAN from 
said collected log information; 

means for passively or actively sending said image to another device via said 
LAN; wherein: 

said image generating means comprises means for generating an image 
visualizing as respective predetermined objects, said device operating in said LAN, a 
device operating in said external network communicating with said device, a user using 
both said devices, and communication conducted between said device to be monitored 
and said device operating in said external network; 

said image generating means comprises a function for generating an 
image structured with an area displaying a text message as it is, an area displaying as a 
graph an appearance frequency of a predetermined character string in said log 
information, an area displaying as a graph an appearance frequency of said character 
string for each predetermined unit time period in a time series, and an area displaying 
as a graph the length of each line of said text message, based on a log information 
structured with various processes conducted in each device described in separate lines 
in a text message format including such content and executing time and date. 

42. (Previously Presented) A security administration server as claimed in 
claim 41 , wherein 

said device operating in said LAN comprises: 
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means for managing a log file which is the entirety of the log information in the 
form of an original file and a plurality of duplicate files thereof managed with the same 
contents as said original file in real time; and 

means for storing and managing each file distributed to a plurality of storing 
places suitable defined in a storing means in said device; 

means for suitably transferring each duplicate file to another storing place; 

means for detecting whether or not there is an abnormality in security in both of 
said original and duplicate log files; and 

wherein image generating means comprises means for reflecting in said image 
the fact an/or its content of detection of said abnormality notified from said device. 

43. (Currently Amended) A security administration server as claimed in any of 
claims 41 to olaim 42, comprising: 

means for receiving an updating data sent from a predetermined computer 
operating in said external network; and 

means for updating a content of a software providing said image generating 
means by said updating data. 

44. (Currently Amended) A security administration server as claimed in any of 
claims 41 to elaira 43, comprising means for transmitting and receiving actively or 
passively said collected log information to and from said computer by communicating 
with a predetermined computer operating in said external network. 
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45. (Currently Amended) A security administration server as claimed in any of 
claims 41 to c l a i m 44, comprising: 

means for storing and managing various setting-registration information such as 
information regarding said device operating in said LAN which is to be an object of 
collecting said log information and information used and referred to by said image 
generating means; and 

means for transmitting and receiving said setting-registration information actively 
or passively to and from said computer by communicating with a predetermined 
computer operating in said external network. 

46. (Currently Amended) A security administration server as claimed in any of 
claims 41 to Glaim 45, comprising: 

means for detecting an abnormality in security of said device or said security 
administration server itself by communicating with a predetermined computer operating 
in said external network, based on said collected log information and a log information 
of said security administration server stored and managed by itself; and 

means for transmitting and receiving actively or passively to and from said 
computer the fact and/or its content when an abnormality is detected. 

47. (Currently Amended) A security administration server as claimed in any of 
claims 41 to c l aim 46, comprising: 

means for communicating based on a TCP/IP protocol with each device in said 

LAN; 



Serial No. 10/084,238 



Page 28 of 35 



means for allocating predetermined IP addresses according to a request from 
said device in said LAN as well as for storing and managing allocated histories 
describing histories of corresponding said IP addresses and MAC addresses of said 
devices; 

means for storing and managing said collected log information by attaching an IP 
address specifying which device said log information concerns; 

means for handling said log information attached with IP addresses 
corresponded to a same MAC address in said allocated history, as log information 
regarding the same device. 

48. (Currently Amended) A security administration server as claimed in claim 
47, comprising: 

means for mutually transmitting and rocoivo receiving said allocated history to 
and from another security administration server operating in said LAN; and 

means for integratedly managing in an integrated manner said receives allocated 
history in another security administration server, and said allocated history stored and 
managed by itself, and for handling said log information attached with IP addresses 
corresponding to a same MAC address in respect to said allocated histories, as a log 
information regarding the same device. 

49. (Currently Amended) A security administration server as claimed in claim 
47 or 48 comprising means for specifying a MAC address wherein each combination of 
MAC address and an IP address described corresponding to said allocated history is 
attached with a valid period information of said IP address, said valid period information 
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and a generated time and date of said log information recorded attached to said 
collected log information are compared, and a MAC address corresponded with an IP 
address attached to said log information at said generated time and date is specified. 

50. (Original) A host server functioning as said predetermined computer in 
claim 43, comprising means for suitably sending said updating data to said security 
administration server. 

51 . (Original) A host server functioning as said predetermined computer in 
claim 44, comprising means for storing and managing said log information sent from 
said security administration server. 

52. (Original) A host server as claimed in claim 51, comprising means for 
sending actively or passively said log information which is stored and managed to said 
security administration server. 

53. (Currently Amended) A host server as claimed in claim 51 or 52, 
comprising: 

means for detecting an abnormality in security of said device in said LAN based 
on said log information which is stored and managed; and 

means for sending to a security administration server installed in a relevant LAN 
the fact and/or its content when an abnormality is detected. 
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54. (Currently Amended) A host server as claimed in any of claims 51 to 
claim 53, comprising means for actively or passively receiving said various setting 
information sent from said security administration server or the fact and/or its content of 
detecting said abnormality and fro storing and managing such information. 

55. (Currently Amended) A host server as claimed in any of claims 53 or 
claim 54, comprising: 

means for communicating with a portable telephone via the Internet or a 
telephone network; and 

means for reporting to a predetermined portable telephone by a voice call or an 
electronic mail, the fact and/or its content when the host server itself detects an 
abnormality or the fact and/or its content of detecting said abnormality sent from said 
security administration server. 

56. (Currently Amended) A host server as claimed in any of claims 51 to 
claim 55, comprising: 

means for communicating with a portable telephone via the Internet; 

means for receiving an inquiry information regarding said log information sent 
from a predetermined portable telephone; 

means for retrieving said log information corresponding to said inquiry message 
from said log information which is stored and managed; and 

means for sending a message describing said retrieved result to said portable 
telephone. 
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57. (Currently Amended) A host server as claimed in any of claims 51 to 
Glaim 56, comprising: 

means for communicating with a portable telephone via the Internet; 

means for receiving information specifying said device operating in said LAN sent 
from a predetermined portable telephone and a processing command executed in said 
device; 

means for sending said processing command to a device specified by said 
specifying information via the Internet; 

means for receiving an execution result of said processing command sent from 
said device for editing said execution result to an image of a form suitable for a user 
interface of said portable telephone and for sending such image to said portable 
telephone. 

58. (Currently Amended) A security administration server as claimed in claim 
[[4]] 7, comprising: 

means for detecting an abnormality in security of said device to be monitored 
based on said communication related information, and 

means for making said image reflect information to that effect and/or its content 
when the abnormality is detected. 

59. (Currently Amended) A security administration server as claimed in claim 
[[4]] 7, comprising means for collecting log information via said LAN, wherein said 
communication related information is log information stored and managed in said device 
to be monitored. 
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60. (Currently Amended) A security administration server as claimed in claim 
[[38]] 41 comprising: 

means for detecting an abnormality in security of a device operating in said LAN 
based on said collected log information; and 

means for making said image reflect information to that effect and/or its content 
when the abnormality is detected. 
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